SQL Injection & Cross Site Scripting

Reading time: 2 – 3 minutes

Feia molt de temps que no escribia cap article al portal referent a la
seguretat. Però fa temps q volia mirar-me un parell de tècniques
q encara no controlava. Així doncs, m’he posat ‘manos a la obra’ i
aprofitant els infinits recursos del ‘google’ i de securityfocus per comensar
he trobat aquestes dues definicions prou interessants:

SQL Injection

SQL Injection refers to the technique of inserting SQL meta-characters and
commands into Web-based input fields in order to manipulate the execution of
the back-end SQL queries.

Cross Site Scripting

Cross Site Scripting attacks work by embedding script tags in URLs and enticing
unsuspecting users to click on them, ensuring that the malicious Javascript
gets executed on the victim’s machine.

Per si algú vol aprofondir més sobre el tema igual que jo he
tingut ganes de fer, doncs aquí va un petit recull de direccions prou
interessants com per perdre-hi unes horetes llegint:

Detection of
SQL Injection and Cross-site Scripting Attacks [Security Focus]

SQL
Injection : Are your web applications vulnerable [SPI Labs]

Advanced SQL Injection In SQL Server Applications [NGSSoftware
Insight Security Research (NISR)]

Finalment un document q ús pot ajudar a fer les coses millor:

Secure Programming for Linux and Unix HOWTO [David A.
Wheeler]

Les transparencies de la presentació de: Secure
Programming for Linux and Unix HOWTO [David A. Wheeler]

Un petit consell si us sobren 10min perdeu-los a la web del autor dels
documents, val la pena:

David A. Wheeler